Software Deployment

ORIGINAL: oofemioo

What concerns me about having multiple packages in a GPO is the fact that if you need to upgrade an application for one group of users/computers (or particular pcs or users in a group to which the apps. have been deployed), all hell will be let loose!




How so? We have the majority of our apps assigned to a single GPO, and I've created many upgrades with no issues.

You can do this as long as you ACL the apps to user groups.

For instance.....We deploy all user based apps in 1 GPO and remove authenticated users and insert app groups so that the user won't get the app unless they are part of the Software Group attached to that app.

You can also do the same in your workstations domain by adding workstations to the software groups instead of users.

This requires more management but helps will lightening the load on the filtering.

Remember that the more GPO's you create the longer the login time will become for each workstation and user.

I do this f.e. if I have a basic pkg (adobe 6 reader) and then an msi as an update (6.0.1 f.e). I then only use one msi.
but be carefull. The first in the list will be applied first! --> Nameconvention

There is now a tool available to set the order of app installs within a GPO. I have it at work but I haven't tested it.

The way it supposedly works is that you can select your apps and place them in whatever order you want them installed.
MS say AD installs them in alphabetic order but I know this isn't true. The ONLY way to ensure the order is to add an app and then go to each app and select "Redeploy" one after the other all the way to the end.

Messy is the word I'm thinking of here.

Sidenote: I once cornered one of the Microsoft developers of the GP MMC on this ordering business and he claimed that "though unsupported" items are applied in the order they are added to the GPO.

hi

what is the name of that tool?

Olivier

ASSM (Assigned Software Sequence Manager) it is available from here

http://www.sywan.nl/metatraffic2/track.asp?mtr=/download/ASSM_0.3.zip

I have tested it and it works great, make sure you give your changes time to replicate.

that's nice thx!

Do you know how they managed to have the list of the GPO object in the AD?

Is there a class (f.e. .NET) where you can read those object?

Regards

Olivier

All I know is that a connection to a specific server must be made, this leads me to believe that it is getting this information from the Policies folder that belong to each server in its own Sysvol directory, this information is then replicated using AD replication. My guess is that the application is interpreting the GPO settings files for the specified GPO.

What concerns me about having multiple packages in a GPO is the fact that if you need to upgrade an application for one group of users/computers (or particular pcs or users in a group to which the apps. have been deployed), all hell will be let loose!

You have a gpo that deploys APP1, APP2......APPN to a group (GPa) of pcs PC1..PC100.

Now you need to upgrade APP1 & APP2 to APP1.1 & APP2.1 respectively only for PC1....PC20 in that group. How do u go ahead.

Also you need to remove APP10 & APP20 from PC80...PC100 in the same group. How do you go about it?

Overrides?

Ah, now I see what you're saying. Yes that would be a problem.

We have the majority of our apps in a single GPO, HOWEVER, we assign each app to its own group, and add users/computers to it appropriately.



On a side note, have you assigned multiply package GPO's to a single group? Does that work? I tried it recently & it failed, though I suspect the issue was the faulty MSI's I used to test with.

Yes you can apply multiple package GPOs to a single group.